Skip to content

feat(demo): draft isolated demo authentication realm #595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tiankaima wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

feat(demo): draft isolated demo authentication realm #595

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ac992ea
feat(demo): draft isolated demo authentication realm
tiankaima Jul 22, 2026
519c28b
fix(demo): harden isolated API boundary
tiankaima Jul 22, 2026
49a0aa5
fix(demo): harden draft API contract
tiankaima Jul 22, 2026
a4117ed
fix(demo): document isolated auth realm
tiankaima Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ DATABASE_URL="postgresql://postgres:[email protected]:5432/life_ustc_dev"
# CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE="postgresql://postgres:[email protected]:5432/life_ustc_dev"
WEBHOOK_SECRET="replace-with-random-secret"
AUTH_SECRET="replace-with-random-secret"
# Draft-only isolated demo realm. Keep disabled unless explicitly testing the
# `/demo` vertical slice; production config intentionally does not enable it.
DEMO_MODE_ENABLED="false"
# DEMO_SIGNING_SECRET="replace-with-at-least-32-random-characters"
# Required in production. Local dev falls back to http://localhost:3000.
# APP_PUBLIC_ORIGIN="https://life-ustc.example.com"
# Optional canonical WebAuthn RP origin when preview and public origins differ.
Expand Down
318 changes: 318 additions & 0 deletions public/openapi.generated.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4435,6 +4435,182 @@
}
}
},
"/api/demo/todos": {
"get": {
"operationId": "get-api-demo-todos",
"summary": "List the immutable demo todo fixture",
"tags": [
"Api"
],
"security": [
{
"demoBearerAuth": []
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/demoTodosResponseSchema"
}
}
}
},
"401": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"403": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"404": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
}
}
},
"post": {
"operationId": "post-api-demo-todos",
"summary": "Simulate creating a demo todo without persistence",
"tags": [
"Api"
],
"security": [
{
"demoBearerAuth": []
}
],
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/demoTodoCreateRequestSchema"
}
}
}
},
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/demoTodoCreateResponseSchema"
}
}
}
},
"400": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"401": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"403": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"404": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
}
}
}
},
"/api/demo/token": {
"post": {
"operationId": "post-api-demo-token",
"summary": "Exchange a demo web session for a short-lived demo API token",
"tags": [
"Api"
],
"security": [
{
"demoSessionCookie": []
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/demoTokenResponseSchema"
}
Comment thread
tiankaima marked this conversation as resolved.
}
}
},
"401": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
},
"404": {
"description": "Error response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/openApiErrorSchema"
}
}
}
}
}
}
},
"/api/homeworks/{id}": {
"patch": {
"operationId": "updateHomework",
Expand Down Expand Up @@ -24500,6 +24676,136 @@
],
"additionalProperties": false
},
"demoTodosResponseSchema": {
"type": "object",
"properties": {
"fixture": {
"type": "boolean",
"enum": [
true
]
},
"todos": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"title": {
"type": "string"
},
"completed": {
"type": "boolean"
},
"priority": {
"type": "string",
"enum": [
"medium",
"high"
]
}
},
"required": [
"id",
"title",
"completed",
"priority"
],
"additionalProperties": false
}
}
},
"required": [
"fixture",
"todos"
],
"additionalProperties": false
},
"demoTodoCreateRequestSchema": {
"type": "object",
"properties": {
"title": {
"type": "string",
"minLength": 1,
"maxLength": 200
}
},
"required": [
"title"
],
"additionalProperties": false
},
"demoTodoCreateResponseSchema": {
"type": "object",
"properties": {
"simulated": {
"type": "boolean",
"enum": [
true
]
},
"todo": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"title": {
"type": "string"
},
"completed": {
"type": "boolean"
},
"priority": {
"type": "string",
"enum": [
"medium",
"high"
]
}
},
"required": [
"id",
"title",
"completed",
"priority"
],
"additionalProperties": false
}
},
"required": [
"simulated",
"todo"
],
"additionalProperties": false
},
"demoTokenResponseSchema": {
"type": "object",
"properties": {
"accessToken": {
"type": "string"
},
"expiresIn": {
"type": "integer",
"exclusiveMinimum": true,
"maximum": 9007199254740991
},
"tokenType": {
"type": "string",
"enum": [
"Bearer"
]
}
},
"required": [
"accessToken",
"expiresIn",
"tokenType"
],
"additionalProperties": false
},
"homeworkUpdateRequestSchema": {
"type": "object",
"properties": {
Expand Down Expand Up @@ -33221,6 +33527,18 @@
"name": "better-auth.session_token",
"description": "Better Auth session cookie used by the web UI. Production cookies may use the __Secure- prefix."
},
"demoBearerAuth": {
"type": "http",
"scheme": "bearer",
"bearerFormat": "JWT",
"description": "Short-lived bearer token issued by /api/demo/token for the isolated, non-persistent demo realm."
},
"demoSessionCookie": {
"type": "apiKey",
"in": "cookie",
"name": "life_ustc_demo",
"description": "Short-lived web session cookie for the isolated demo realm. It is not a Better Auth session."
},
"mcpBearerAuth": {
"type": "http",
"scheme": "bearer",
Expand Down
14 changes: 14 additions & 0 deletions scripts/openapi/generate.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,20 @@ const SECURITY_SCHEMES = {
description:
"Better Auth session cookie used by the web UI. Production cookies may use the __Secure- prefix.",
},
demoBearerAuth: {
type: "http" as const,
scheme: "bearer",
bearerFormat: "JWT",
description:
"Short-lived bearer token issued by /api/demo/token for the isolated, non-persistent demo realm.",
},
demoSessionCookie: {
type: "apiKey" as const,
in: "cookie" as const,
name: "life_ustc_demo",
description:
"Short-lived web session cookie for the isolated demo realm. It is not a Better Auth session.",
},
mcpBearerAuth: {
type: "http" as const,
scheme: "bearer",
Expand Down
8 changes: 8 additions & 0 deletions scripts/openapi/route-collector.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -561,6 +561,14 @@ function buildSecurity(
return undefined;
}

if (routePath === "/api/demo/token") {
return [{ demoSessionCookie: [] }];
}

if (routePath.startsWith("/api/demo/")) {
return [{ demoBearerAuth: [] }];
}

if (tag === "Admin") {
return [{ sessionCookie: [] }];
}
Expand Down
Loading